Pin MessagePack package version to fix restore audit warning (#7484)

Author: kartheekp-ms

Directory.Packages.props

@@ -110,6 +110,7 @@
     Once the packages depending on these packages are upgraded, these PackageVersions can be removed.
   -->
   <ItemGroup>
+    <PackageVersion Include="MessagePack" Version="2.5.302" />
     <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="5.7.0" />
     <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="5.7.0" />
   </ItemGroup>

src/NuGet.Clients/NuGet.VisualStudio.Contracts/NuGet.VisualStudio.Contracts.csproj

@@ -22,6 +22,8 @@
       These packages are dependencies of directly referenced PackageReferences.
       When the above PackageReferences are upgraded to newer versions, try deleting the below PackageReferences
       -->
+    <!-- Microsoft.ServiceHub.Framework has a dependency on a vulnerable version of MessagePack. Once it no longer has a transitive dependency on a vulnerable version, this can be removed -->
+    <PackageReference Include="MessagePack" />
     <!-- We do this to avoid the warning our build raises about keeping a consistent newtonsoft.json version. We don't need newtonsonft.json type in here, we don't use it. -->
     <PackageReference Include="Newtonsoft.Json" PrivateAssets="all" ExcludeAssets="all" />
   </ItemGroup>

src/NuGet.Clients/NuGet.VisualStudio.Internal.Contracts/NuGet.VisualStudio.Internal.Contracts.csproj

@@ -9,6 +9,8 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.VisualStudio.Sdk" />
+    <!-- Microsoft.VisualStudio.Sdk has a dependency on a vulnerable version of MessagePack. Once it no longer has a transitive dependency on a vulnerable version, this can be removed -->
+    <PackageReference Include="MessagePack" />
   </ItemGroup>
 
   <ItemGroup>

src/NuGet.Clients/NuGet.VisualStudio.Interop/NuGet.VisualStudio.Interop.csproj

@@ -16,6 +16,8 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.VisualStudio.Shell.15.0" />
     <PackageReference Include="Microsoft.VisualStudio.Shell.Styles" />
+    <!-- Microsoft.VisualStudio.Shell.15.0 has a dependency on a vulnerable version of MessagePack. Once it no longer has a transitive dependency on a vulnerable version, this can be removed -->
+    <PackageReference Include="MessagePack" />
     <PackageReference Include="Newtonsoft.Json" ExcludeAssets="all" />
   </ItemGroup>
 

test/NuGet.Tests.Apex/NuGet.OptProf/NuGet.OptProf.csproj

@@ -16,6 +16,8 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Test.Apex.VisualStudio" ExcludeAssets="Compile" GeneratePathProperty="true" />
     <PackageReference Include="Microsoft.VisualStudio.Sdk" />
+    <!-- Microsoft.VisualStudio.Sdk has a dependency on a vulnerable version of MessagePack. Once it no longer has a transitive dependency on a vulnerable version, this can be removed -->
+    <PackageReference Include="MessagePack" />
     <PackageReference Include="MSTest.TestAdapter" />
     <PackageReference Include="MSTest.TestFramework" />
     <PackageReference Include="Newtonsoft.Json" NoWarn="NU1605" />